diff options
| author | Justin Ruggles <justin.ruggles@gmail.com> | 2011-09-27 14:27:43 -0400 |
|---|---|---|
| committer | Justin Ruggles <justin.ruggles@gmail.com> | 2011-10-27 22:06:32 -0400 |
| commit | e2e6c8799b3c4a61b8be36c84c5e5e15c49a31cd (patch) | |
| tree | bc2733fb854b6a73b0ae669cbb5c6d662df8549c | |
| parent | 512557b291d97ce72dc00e8c1e9a8c1c782fade9 (diff) | |
| download | ffmpeg-e2e6c8799b3c4a61b8be36c84c5e5e15c49a31cd.tar.gz | |
mpegaudiodec: check output data size based on avctx->frame_size
| -rw-r--r-- | libavcodec/mpegaudiodec.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavcodec/mpegaudiodec.c b/libavcodec/mpegaudiodec.c index 3aef5fb08d..58e2bf7c38 100644 --- a/libavcodec/mpegaudiodec.c +++ b/libavcodec/mpegaudiodec.c @@ -1795,7 +1795,7 @@ static int decode_frame(AVCodecContext * avctx, void *data, int *data_size, avctx->bit_rate = s->bit_rate; avctx->sub_id = s->layer; - if (*data_size < 1152 * avctx->channels * sizeof(OUT_INT)) + if (*data_size < avctx->frame_size * avctx->channels * sizeof(OUT_INT)) return AVERROR(EINVAL); *data_size = 0; @@ -1871,6 +1871,9 @@ static int decode_frame_adu(AVCodecContext *avctx, void *data, int *data_size, avctx->bit_rate = s->bit_rate; avctx->sub_id = s->layer; + if (*data_size < avctx->frame_size * avctx->channels * sizeof(OUT_INT)) + return AVERROR(EINVAL); + s->frame_size = len; #if FF_API_PARSE_FRAME |